Konfir is built to the same standards used by banks and government services. Every connection and every part of our platform uses strong encryption and strict access controls, so your information stays secure at all times. Access is one-time, read-only, and handled via secure APIs — never by email or manual processes.

When you connect a source (Banking, HMRC, or Payroll), the connection is made using secure, encrypted APIs:

You authenticate directly with your bank. Konfir receives only the salary/payment data needed for your verification. Login details never pass through or are seen by Konfir. Open Banking is regulated by the Financial Conduct Authority (FCA).

You log in to your HMRC account and approve a one-time access request. Konfir receives a secure read-only snapshot of your PAYE or self-assessment data. Access closes automatically once data is retrieved.

Data is transferred securely via APIs between your employer’s payroll provider and Konfir. Sensitive payroll data is never shared via email or manual files.

All information handled within Konfir is protected by multiple layers of security:

All data is encrypted in transit (while moving) and at rest (while stored) using industry-standard protocols.

Only authorised Konfir staff with a genuine operational need can access sensitive systems, managed through role-based permissions.

We maintain continuous logging, intrusion detection, and regular penetration testing.

Konfir runs entirely on Amazon Web Services (AWS), a leading provider of enterprise-grade cloud security and resilience.
​

Konfir is ISO 27001 certified and registered under the UK Digital Identity & Attributes Trust Framework (UKDIATF).

👉 In short: every connection you make is via secure, regulated APIs, and Konfir’s platform is designed and independently audited to bank-level security standards.